GOXLR-malware-family

This repo initially was my analysis and report for malware found at goxlr.net. Recently I uncovered they ALSO ran several other malware domains with varying malware variants, so far all stealers, and they are all a clone of "goxlr". So I am now reverse engineering every sample I can find from all...

fronthunter

FrontHunter FrontHunter is a tool for testing large lists of domains to identify candidates for domain fronting. Domain Fronting? Really? I know, I know… domain fronting is pretty old. But the truth is, it’s still useful as just another feature to include in your C2 infrastructure. When it comes ...

BounceBack

BounceBack ↕️🤫 Stealth redirector for your red team operation security. Overview BounceBack is a powerful, highly customizable and configurable reverse proxy with WAF functionality for hiding your C2/phishing/etc infrastructure from blue teams, sandboxes, scanners, etc. It uses real-time traffic...

APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

DoH_c2_Trigger

DoHc2Trigger Code for blogpost: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/...

ycsm

You Can't See Me YCSM This is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular RATS Cobalt Strike, Empire, Metasploit. If HTTPS was selected, it will automatically setup letsencrypt certbot and obtain valid letsencrypt SSL...

BitLock-Crypto-Research

🛡️ BitLock Framework: Cryptovirology and C2 Ecosystem PoC This repository contains a comprehensive Proof of Concept PoC designed for the study of modern threat architectures. The project simulates a fileless attack environment with a command and control C2 infrastructure protected by elliptic curv...

GithubC2

GithubC2 Demostración de Github como C2, API gratuita = infraestructura C2 gratuita Demostración https://user-images.githubusercontent.com/110354855/192076474-3c1884f8-4a59-4944-b0d6-9dc59c7692f0.mp4...

AutoFunkt

AutoFunkt root@kitploit: d8888 888 8888888888 888 888 d88888 888 888 888 888 d88P888 888 888 888 888 d88P 888 888 888 888888 .d b. 8888888 888 888 88888b. 888 888 888888 d88P 888 888 888 888 d88 88b 888 888 888 888 "88b 888 .88P 888 d88P 888 888 888 888 888 888 888 888 888 888888K 888 d8888888888...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. C2 Infrastructure – Resilient & Redundant Servers Process Hacker memory analysis reveals a comprehensive list of domains used by Dropper GCleaner for C2 communication. These domains are hosted on various platforms Scaleway, Render, Replit, etc., indicating a robust and redundant infrastructure...

CVE-2026-33634-Scanner

CVE-2026-33634-Scanner Automated scanner for detecting indicators of compromise IOCs associated with the TeamPCP supply chain attack CVE-2026-33634 📋 Table of Contents Overview Vulnerability Features Detected IOCs Installation Usage Examples Report Format Project Structure System Requirements...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit TRU, the backdoor is a compiled C/C++ implant delivered ...

Malicious code in @marketfront/baobabtech (npm)

The @marketfront/baobabtech package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-6786 Malicious code in @marketfront/mychatspreloader (npm)

The @marketfront/mychatspreloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and us...

MAL-2026-6772 Malicious code in @marketfront/customdealsfeed (npm)

The @marketfront/customdealsfeed package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-5164 Malicious code in @emcd-vue/b2b-pay-form (npm)

Part of a coordinated multi-package supply-chain attack impersonating EMCD emcd.io, a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the @emcd-vue npm scope to distribute multiple malicious packages posing as internal tooling under the "EMCD Platform...

New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations

Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations NGOs and suspected universities to deliver a newly identified malware family, "LucidRook." LucidRook is a sophisticated stager that embeds a Lua...

New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys

Android device users in South Korea have emerged as a target of a new mobile malware campaign that delivers a new type of threat dubbed SpyAgent. The malware "targets mnemonic keys by scanning for images on your device that might contain them," McAfee Labs researcher SangRyol Ryu said in an...

Living off the land with Bluetooth PAN

TL:DR Bluetooth is enabled by default on the majority of Windows laptops Bluetooth PAN can be used to bridge connections locally between a client laptop and attacking device Attackers can use Microsoft native SSH client to forward out internal network traffic Windows native SSH is accessible to...